Thinking in risk — and the seven characteristics

Lesson 2 of 5 in NIST AI RMF Deep Dive: Govern, Map, Measure, Manage.

The RMF defines risk the way engineers and insurers always have: risk is a composite of the likelihood of an event and the magnitude of its consequences. Two things about NIST’s version matter more than the formula.

First, the consequences run wider than the balance sheet. The RMF explicitly scopes harm to people (civil liberties, physical and psychological safety, economic opportunity), to organizations (operations, reputation, legal exposure), and to ecosystems (supply chains, the information environment, the planet). A framework that only counted enterprise risk would miss the reason AI governance exists.

Second, AI risk is not software risk with a new label. Conventional software fails in ways its specifications predict; AI systems fail in ways their training data and deployment context determine. Risks can emerge from use in unforeseen settings, from drift long after release, and from the opacity that defeats ordinary code review. NIST is blunt about the consequence: AI risks for which there is no precedent must still be managed — “we have never measured that” is a gap to close, not an excuse.

Four risk-vocabulary terms recur through the entire framework, and every one of them is a decision, not a discovery:

  • Risk tolerance — how much risk the organization is willing to carry to get the benefit. The RMF pointedly refuses to set it for you: tolerance is contextual, set by leadership under GOVERN, informed by law and stakeholders.
  • Risk prioritization — you cannot treat everything. Highest-consequence, highest-likelihood risks get resources first; a triage model touching patient safety outranks a lunch-menu chatbot.
  • Residual risk — what remains after treatment. The RMF requires it to be documented and communicated to downstream users and operators, because pretending treatment eliminated risk is how incidents become scandals.
  • Zero is not on the menu. NIST states outright that risk cannot be eliminated, only managed. Any vendor or policy promising risk-free AI has already failed the framework’s first literacy test.

What are you managing risk toward? The RMF’s answer is its most-quoted export: seven characteristics of trustworthy AI. They are the target state every function aims at, the rubric MEASURE tests against, and — because ISO, the OECD, and half the state statutes echo them — the closest thing US AI governance has to a shared vocabulary of quality.

Valid and reliable — the non-negotiable baseline

The system does what it claims, accurately, consistently, under the conditions of expected use. NIST calls this a necessary condition: an invalid system cannot be trustworthy no matter how private, fair, or transparent it is. Validity is demonstrated by ongoing testing, not asserted — a model validated on 2023 data has proven nothing about 2026.

Safe

The system does not, under defined conditions, endanger human life, health, property, or the environment. Safety practice imports decades of learning from transportation and medicine: rigorous simulation before deployment, real-time monitoring, and — critically — the documented ability to shut the system down when it misbehaves.

Secure and resilient

The system withstands attack (security) and degrades gracefully rather than catastrophically when conditions go wrong (resilience). For AI this means the novel attack surface too: data poisoning, model and training-data extraction, adversarial examples, and — for generative systems — prompt injection.

Accountable and transparent

Someone identifiable answers for the system, and information about it — what it is, what data built it, who is responsible, what it should and should not be used for — is available to the people who need it. Transparency is the enabler characteristic: without it, nobody can verify any of the other six. It spans the spectrum from “you are talking to an AI” disclosures to full documentation packages.

Explainable and interpretable

Explainability: you can describe how the system reached an output. Interpretability: you can say what the output means in context. These power everything downstream — a credit denial can only carry the specific reasons ECOA requires if someone can extract reasons from the model. Note the distinction from transparency: transparency is about the system’s existence and construction; explainability is about its individual answers.

Privacy-enhanced

Norms of anonymity, confidentiality, and control are protected by design — data minimization, de-identification, and privacy-enhancing technologies where they fit. AI puts privacy under new pressure: models can memorize training data and leak it, and inference can reconstruct sensitive facts (pregnancy, illness, orientation) nobody ever collected.

Fair — with harmful bias managed

Equality and equity concerns are addressed, and the three bias families NIST catalogues in SP 1270 — systemic, computational, human-cognitive — are actively managed. NIST is careful with this one: fairness is context-dependent and contested, so the characteristic is phrased as managing harmful bias, not achieving a single mathematical “fair”. The genai-and-bias module drills this in depth.

Key terms: risk tolerance, residual risk, trustworthy AI characteristics, TEVV, prompt injection

Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.